Awesome

docker-elastalert

Docker image for running Elastalert.

Features

• Docker container that conforms to The Twelve-Factor App Section III configuration guidelines by making everything available using environment variables.
• Integration with the following external services via environment variables:
  • E-mail (General SMTP)
  • Exotel
  • Gitter
  • HipChat
  • JIRA
  • OpsGenie
  • PagerDuty
  • Slack
  • Telegram
  • Twilio
  • VictorOps
• NTP syncrhonization
• Rules checking on container startup if rules/ directory is populated

Usage

Locally the docker-elastalert instance can be run using the following command:

docker-compose up -d --build

The local cluster spins up a dummy Elasticsearch container, and then the Elastalert container. When the Elastalert container starts, the CMD script runs through the following processes:

• Checks the Elastalert rules located in ${RULES_FOLDER} if any exists
• Sets container timezone to ${CONTAINER_TIMEZONE} if the ${SET_CONTAINER_TIMEZONE} is set to True. The default is Etc/UTC.
• Starts the NTP daemon for time synchronization. This requires the following Linux capabilities set via cap_add: SYS_NICE and SYS_TIME.
• Populates the Elastalert template located at ${CONFIG_DIR}/elastalert_config.yaml.tmpl with environment variables using the dockerize binary.
• Loops a wget command until the Elasticsearch instance located at ${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT} becomes available.
• Runs elastalert-create-index if the specified ${ELASTALERT_INDEX} hasn't yet been created,
• Executes the python daemon.

Credit

• Dockerize project for populating configuration templates: jwilder/dockerize
• Dumb-init system used for proper forking off of PID 1: Yelp/dumb-init
• Much of this repositiory was based off of the docker-elastalert repo from krizsan: krizsan/elastalert-docker

Environment Variables

Set at buildtime

These variables are set during the Docker build, and are generally necessary for running core functionality of Elastalert.

Set at runtime

These variables are settings available in the Elastalert configuration file. Most of these settings apply to third-party integrations (JIRA, OpsGenie, etc), or are things documented here: Elastalert common configuration options